Demo Vault Agent

vault auth enable approle

Success! Enabled approle auth method at: approle/

vault write auth/approle/role/agent \
  token_policies="cloud-policy"

vault read auth/approle/role/agent

vault read -format=json auth/approle/role/agent/role-id

vault write -f auth/approle/role/agent/secret-id

{
  "data": {
    "role_id": "3ae4b467-c469-6a38-adbe-83e1ab5f1dd0",
    "secret_id": "6b74a5ef-d4f5-0690-67f1-c457c1060ac7"
  }
}

3ae4b467-c469-6a38-adbe-83e1ab5f1dd0

6b74a5ef-d4f5-0690-67f1-c457c1060ac7

auto_auth {
  method "approle" {
    mount_path = "approle"
    config = {
      role_id_file_path    = "/path/to/role.txt"
      secret_id_file_path  = "/path/to/secret.txt"
    }
  }

  sink "file" {
    config = {
      path = "/path/to/sink.txt"
    }
  }
}

vault {
  address = "http://127.0.0.1:8200"
}

vault agent -config=agent.hcl

[INFO] sink.file: file sink configured: path=/path/to/sink.txt
[INFO] auth.handler: authentication successful, sending token to sinks
[INFO] auth.handler: renewed auth token

cat /path/to/sink.txt
# s.xxxxxxxxxxxxxxxxxxxxxxxx

auto_auth {
  method "approle" {
    mount_path = "approle"
    config = {
      role_id_file_path      = "/path/to/role.txt"
      secret_id_file_path    = "/path/to/secret.txt"
      remove_secret_id_file  = false
    }
  }
  sink "file" {
    config = {
      path = "/path/to/sink.txt"
    }
  }
}

production:
  adapter: postgresql
  encoding: unicode
  database: orders
{{ with secret "kv/apps/webapp" }}
  username: "{{ .Data.data.username }}"
  password: "{{ .Data.data.password }}"
{{ end }}

vault kv put kv/apps/webapp \
  username="administrator" \
  password="kfi3ksoi2msij2s"

template {
  source      = "/path/to/web.tmpl"
  destination = "/path/to/output.yaml"
}

template {
  source      = "/path/to/web.tmpl"
  destination = "/path/to/output.yaml"
}

vault {
  address = "http://127.0.0.1:8200"
}

vault agent -config=agent.hcl

cat /path/to/output.yaml

production:
  adapter: postgresql
  encoding: unicode
  database: orders
  username: "administrator"
  password: "kfi3ksoi2msij2s"